An uncontrolled memory allocation error exists in the Media Download Handler of CowAgent, triggered by a function that accepts remote requests without proper bounds checking. This flaw can be exploited over the network, allowing an attacker to force the application to allocate large amounts of memory, eventually consuming system resources and causing the service to become unresponsive. The vulnerability is publicly disclosed and considered exploitable.

The issue affects zhayujie CowAgent versions up to 2.1.9. All users of these releases are at risk until the component is updated to version 2.2.0, which contains the relevant patch.

The CVSS score of 5.3 indicates a moderate severity. EPSS is not available, and the flaw is not listed in CISA’s KEV catalog, but the remote nature of the attack vector and the potential for resource exhaustion mean an attacker could realistically disrupt service. The lack of an exploit mitigation in current releases enhances the likelihood of a successful denial‑of‑service exploitation.